rootpwn

low · CVSS v3 2.7

CVE-2026-100271

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to acce…

Description

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

Scores

Severity
low
CVSS v2
3.3
CVSS v3
2.7
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

low

CVE-2026-100264

In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

View analysis

low

CVE-2026-100270

In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations

View analysis

low

CVE-2026-100280

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

View analysis

low

CVE-2026-103436

apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.

View analysis